#Agent tool allow precedence

1 messages · Page 1 of 1 (latest)

thorn jasper
#

On the doc page https://docs.openclaw.ai/tools/multi-agent-sandbox-tools example 2b it demonstrates setting an explicit profile in agents.list[].tools and another explicit tool allow and shows that the allows are additive. But in my experience, plus a separate doc page, it seems to indicate that if agents.list[].tools is non-empty, all tools are denied.

What is the best convention for explicitly allowing additional tools after a tool profile for an agent?

near saffronBOT
full doveBOT
#

To help others find answers, you can mark your question as solved via Right click solution message -> Apps -> ✅ Mark Solution

upbeat riverBOT
#

Let me verify the docs source first, then I’ll answer from the actual text/code instead of guessing.

#

I found the important bit: there’s a newer alsoAllow field in config/schema, and that’s the additive one. I’m checking the implementation now so I don’t misstate behavior.

#

Short version: use profile + alsoAllow.

{
  agents: {
    list: [
      {
        id: "support",
        tools: {
          profile: "messaging",
          alsoAllow: ["slack"]
        }
      }
    ]
  }
}
#

Current behavior is:

  • profile = base baseline
  • alsoAllow = additive on top of that baseline
  • allow = restrictive allowlist mode, not additive
  • deny still wins

So if agents.list[].tools.allow is non-empty, everything else is treated as blocked at that scope. That means the example using profile + allow as if it were additive is misleading for current behavior.

One more important bit: you cannot set allow and alsoAllow together in the same scope.

So the best convention is:

  • use profile for the baseline
  • use alsoAllow for a few extra tools
  • use allow only when you want a fully explicit allow-only list